# coding=utf-8
# *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
# *** Do not edit by hand unless you're certain you know what you are doing! ***

import copy
import warnings
import pulumi
import pulumi.runtime
from typing import Any, Mapping, Optional, Sequence, Union, overload
from .. import _utilities

__all__ = [
    'AccessBoundaryPolicyRuleArgs',
    'AccessBoundaryPolicyRuleAccessBoundaryRuleArgs',
    'AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionArgs',
    'DenyPolicyRuleArgs',
    'DenyPolicyRuleDenyRuleArgs',
    'DenyPolicyRuleDenyRuleDenialConditionArgs',
    'WorkforcePoolProviderOidcArgs',
    'WorkforcePoolProviderOidcClientSecretArgs',
    'WorkforcePoolProviderOidcClientSecretValueArgs',
    'WorkforcePoolProviderOidcWebSsoConfigArgs',
    'WorkforcePoolProviderSamlArgs',
    'WorkloadIdentityPoolProviderAwsArgs',
    'WorkloadIdentityPoolProviderOidcArgs',
]

@pulumi.input_type
class AccessBoundaryPolicyRuleArgs:
    def __init__(__self__, *,
                 access_boundary_rule: Optional[pulumi.Input['AccessBoundaryPolicyRuleAccessBoundaryRuleArgs']] = None,
                 description: Optional[pulumi.Input[str]] = None):
        """
        :param pulumi.Input['AccessBoundaryPolicyRuleAccessBoundaryRuleArgs'] access_boundary_rule: An access boundary rule in an IAM policy.
               Structure is documented below.
        :param pulumi.Input[str] description: The description of the rule.
        """
        if access_boundary_rule is not None:
            pulumi.set(__self__, "access_boundary_rule", access_boundary_rule)
        if description is not None:
            pulumi.set(__self__, "description", description)

    @property
    @pulumi.getter(name="accessBoundaryRule")
    def access_boundary_rule(self) -> Optional[pulumi.Input['AccessBoundaryPolicyRuleAccessBoundaryRuleArgs']]:
        """
        An access boundary rule in an IAM policy.
        Structure is documented below.
        """
        return pulumi.get(self, "access_boundary_rule")

    @access_boundary_rule.setter
    def access_boundary_rule(self, value: Optional[pulumi.Input['AccessBoundaryPolicyRuleAccessBoundaryRuleArgs']]):
        pulumi.set(self, "access_boundary_rule", value)

    @property
    @pulumi.getter
    def description(self) -> Optional[pulumi.Input[str]]:
        """
        The description of the rule.
        """
        return pulumi.get(self, "description")

    @description.setter
    def description(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "description", value)


@pulumi.input_type
class AccessBoundaryPolicyRuleAccessBoundaryRuleArgs:
    def __init__(__self__, *,
                 availability_condition: Optional[pulumi.Input['AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionArgs']] = None,
                 available_permissions: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 available_resource: Optional[pulumi.Input[str]] = None):
        """
        :param pulumi.Input['AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionArgs'] availability_condition: The availability condition further constrains the access allowed by the access boundary rule.
               Structure is documented below.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] available_permissions: A list of permissions that may be allowed for use on the specified resource.
        :param pulumi.Input[str] available_resource: The full resource name of a Google Cloud resource entity.
        """
        if availability_condition is not None:
            pulumi.set(__self__, "availability_condition", availability_condition)
        if available_permissions is not None:
            pulumi.set(__self__, "available_permissions", available_permissions)
        if available_resource is not None:
            pulumi.set(__self__, "available_resource", available_resource)

    @property
    @pulumi.getter(name="availabilityCondition")
    def availability_condition(self) -> Optional[pulumi.Input['AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionArgs']]:
        """
        The availability condition further constrains the access allowed by the access boundary rule.
        Structure is documented below.
        """
        return pulumi.get(self, "availability_condition")

    @availability_condition.setter
    def availability_condition(self, value: Optional[pulumi.Input['AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionArgs']]):
        pulumi.set(self, "availability_condition", value)

    @property
    @pulumi.getter(name="availablePermissions")
    def available_permissions(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        A list of permissions that may be allowed for use on the specified resource.
        """
        return pulumi.get(self, "available_permissions")

    @available_permissions.setter
    def available_permissions(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "available_permissions", value)

    @property
    @pulumi.getter(name="availableResource")
    def available_resource(self) -> Optional[pulumi.Input[str]]:
        """
        The full resource name of a Google Cloud resource entity.
        """
        return pulumi.get(self, "available_resource")

    @available_resource.setter
    def available_resource(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "available_resource", value)


@pulumi.input_type
class AccessBoundaryPolicyRuleAccessBoundaryRuleAvailabilityConditionArgs:
    def __init__(__self__, *,
                 expression: pulumi.Input[str],
                 description: Optional[pulumi.Input[str]] = None,
                 location: Optional[pulumi.Input[str]] = None,
                 title: Optional[pulumi.Input[str]] = None):
        """
        :param pulumi.Input[str] expression: Textual representation of an expression in Common Expression Language syntax.
        :param pulumi.Input[str] description: Description of the expression. This is a longer text which describes the expression,
               e.g. when hovered over it in a UI.
        :param pulumi.Input[str] location: String indicating the location of the expression for error reporting,
               e.g. a file name and a position in the file.
               
               - - -
        :param pulumi.Input[str] title: Title for the expression, i.e. a short string describing its purpose.
               This can be used e.g. in UIs which allow to enter the expression.
        """
        pulumi.set(__self__, "expression", expression)
        if description is not None:
            pulumi.set(__self__, "description", description)
        if location is not None:
            pulumi.set(__self__, "location", location)
        if title is not None:
            pulumi.set(__self__, "title", title)

    @property
    @pulumi.getter
    def expression(self) -> pulumi.Input[str]:
        """
        Textual representation of an expression in Common Expression Language syntax.
        """
        return pulumi.get(self, "expression")

    @expression.setter
    def expression(self, value: pulumi.Input[str]):
        pulumi.set(self, "expression", value)

    @property
    @pulumi.getter
    def description(self) -> Optional[pulumi.Input[str]]:
        """
        Description of the expression. This is a longer text which describes the expression,
        e.g. when hovered over it in a UI.
        """
        return pulumi.get(self, "description")

    @description.setter
    def description(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "description", value)

    @property
    @pulumi.getter
    def location(self) -> Optional[pulumi.Input[str]]:
        """
        String indicating the location of the expression for error reporting,
        e.g. a file name and a position in the file.

        - - -
        """
        return pulumi.get(self, "location")

    @location.setter
    def location(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "location", value)

    @property
    @pulumi.getter
    def title(self) -> Optional[pulumi.Input[str]]:
        """
        Title for the expression, i.e. a short string describing its purpose.
        This can be used e.g. in UIs which allow to enter the expression.
        """
        return pulumi.get(self, "title")

    @title.setter
    def title(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "title", value)


@pulumi.input_type
class DenyPolicyRuleArgs:
    def __init__(__self__, *,
                 deny_rule: Optional[pulumi.Input['DenyPolicyRuleDenyRuleArgs']] = None,
                 description: Optional[pulumi.Input[str]] = None):
        """
        :param pulumi.Input['DenyPolicyRuleDenyRuleArgs'] deny_rule: A deny rule in an IAM deny policy.
               Structure is documented below.
        :param pulumi.Input[str] description: The description of the rule.
        """
        if deny_rule is not None:
            pulumi.set(__self__, "deny_rule", deny_rule)
        if description is not None:
            pulumi.set(__self__, "description", description)

    @property
    @pulumi.getter(name="denyRule")
    def deny_rule(self) -> Optional[pulumi.Input['DenyPolicyRuleDenyRuleArgs']]:
        """
        A deny rule in an IAM deny policy.
        Structure is documented below.
        """
        return pulumi.get(self, "deny_rule")

    @deny_rule.setter
    def deny_rule(self, value: Optional[pulumi.Input['DenyPolicyRuleDenyRuleArgs']]):
        pulumi.set(self, "deny_rule", value)

    @property
    @pulumi.getter
    def description(self) -> Optional[pulumi.Input[str]]:
        """
        The description of the rule.
        """
        return pulumi.get(self, "description")

    @description.setter
    def description(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "description", value)


@pulumi.input_type
class DenyPolicyRuleDenyRuleArgs:
    def __init__(__self__, *,
                 denial_condition: Optional[pulumi.Input['DenyPolicyRuleDenyRuleDenialConditionArgs']] = None,
                 denied_permissions: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 denied_principals: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 exception_permissions: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 exception_principals: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None):
        """
        :param pulumi.Input['DenyPolicyRuleDenyRuleDenialConditionArgs'] denial_condition: User defined CEVAL expression. A CEVAL expression is used to specify match criteria such as origin.ip, source.region_code and contents in the request header.
               Structure is documented below.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] denied_permissions: The permissions that are explicitly denied by this rule. Each permission uses the format `{service-fqdn}/{resource}.{verb}`,
               where `{service-fqdn}` is the fully qualified domain name for the service. For example, `iam.googleapis.com/roles.list`.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] denied_principals: The identities that are prevented from using one or more permissions on Google Cloud resources.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] exception_permissions: Specifies the permissions that this rule excludes from the set of denied permissions given by deniedPermissions.
               If a permission appears in deniedPermissions and in exceptionPermissions then it will not be denied.
               The excluded permissions can be specified using the same syntax as deniedPermissions.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] exception_principals: The identities that are excluded from the deny rule, even if they are listed in the deniedPrincipals.
               For example, you could add a Google group to the deniedPrincipals, then exclude specific users who belong to that group.
        """
        if denial_condition is not None:
            pulumi.set(__self__, "denial_condition", denial_condition)
        if denied_permissions is not None:
            pulumi.set(__self__, "denied_permissions", denied_permissions)
        if denied_principals is not None:
            pulumi.set(__self__, "denied_principals", denied_principals)
        if exception_permissions is not None:
            pulumi.set(__self__, "exception_permissions", exception_permissions)
        if exception_principals is not None:
            pulumi.set(__self__, "exception_principals", exception_principals)

    @property
    @pulumi.getter(name="denialCondition")
    def denial_condition(self) -> Optional[pulumi.Input['DenyPolicyRuleDenyRuleDenialConditionArgs']]:
        """
        User defined CEVAL expression. A CEVAL expression is used to specify match criteria such as origin.ip, source.region_code and contents in the request header.
        Structure is documented below.
        """
        return pulumi.get(self, "denial_condition")

    @denial_condition.setter
    def denial_condition(self, value: Optional[pulumi.Input['DenyPolicyRuleDenyRuleDenialConditionArgs']]):
        pulumi.set(self, "denial_condition", value)

    @property
    @pulumi.getter(name="deniedPermissions")
    def denied_permissions(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        The permissions that are explicitly denied by this rule. Each permission uses the format `{service-fqdn}/{resource}.{verb}`,
        where `{service-fqdn}` is the fully qualified domain name for the service. For example, `iam.googleapis.com/roles.list`.
        """
        return pulumi.get(self, "denied_permissions")

    @denied_permissions.setter
    def denied_permissions(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "denied_permissions", value)

    @property
    @pulumi.getter(name="deniedPrincipals")
    def denied_principals(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        The identities that are prevented from using one or more permissions on Google Cloud resources.
        """
        return pulumi.get(self, "denied_principals")

    @denied_principals.setter
    def denied_principals(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "denied_principals", value)

    @property
    @pulumi.getter(name="exceptionPermissions")
    def exception_permissions(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        Specifies the permissions that this rule excludes from the set of denied permissions given by deniedPermissions.
        If a permission appears in deniedPermissions and in exceptionPermissions then it will not be denied.
        The excluded permissions can be specified using the same syntax as deniedPermissions.
        """
        return pulumi.get(self, "exception_permissions")

    @exception_permissions.setter
    def exception_permissions(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "exception_permissions", value)

    @property
    @pulumi.getter(name="exceptionPrincipals")
    def exception_principals(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        The identities that are excluded from the deny rule, even if they are listed in the deniedPrincipals.
        For example, you could add a Google group to the deniedPrincipals, then exclude specific users who belong to that group.
        """
        return pulumi.get(self, "exception_principals")

    @exception_principals.setter
    def exception_principals(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "exception_principals", value)


@pulumi.input_type
class DenyPolicyRuleDenyRuleDenialConditionArgs:
    def __init__(__self__, *,
                 expression: pulumi.Input[str],
                 description: Optional[pulumi.Input[str]] = None,
                 location: Optional[pulumi.Input[str]] = None,
                 title: Optional[pulumi.Input[str]] = None):
        """
        :param pulumi.Input[str] expression: Textual representation of an expression in Common Expression Language syntax.
        :param pulumi.Input[str] description: Description of the expression. This is a longer text which describes the expression,
               e.g. when hovered over it in a UI.
        :param pulumi.Input[str] location: String indicating the location of the expression for error reporting,
               e.g. a file name and a position in the file.
               
               - - -
        :param pulumi.Input[str] title: Title for the expression, i.e. a short string describing its purpose.
               This can be used e.g. in UIs which allow to enter the expression.
        """
        pulumi.set(__self__, "expression", expression)
        if description is not None:
            pulumi.set(__self__, "description", description)
        if location is not None:
            pulumi.set(__self__, "location", location)
        if title is not None:
            pulumi.set(__self__, "title", title)

    @property
    @pulumi.getter
    def expression(self) -> pulumi.Input[str]:
        """
        Textual representation of an expression in Common Expression Language syntax.
        """
        return pulumi.get(self, "expression")

    @expression.setter
    def expression(self, value: pulumi.Input[str]):
        pulumi.set(self, "expression", value)

    @property
    @pulumi.getter
    def description(self) -> Optional[pulumi.Input[str]]:
        """
        Description of the expression. This is a longer text which describes the expression,
        e.g. when hovered over it in a UI.
        """
        return pulumi.get(self, "description")

    @description.setter
    def description(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "description", value)

    @property
    @pulumi.getter
    def location(self) -> Optional[pulumi.Input[str]]:
        """
        String indicating the location of the expression for error reporting,
        e.g. a file name and a position in the file.

        - - -
        """
        return pulumi.get(self, "location")

    @location.setter
    def location(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "location", value)

    @property
    @pulumi.getter
    def title(self) -> Optional[pulumi.Input[str]]:
        """
        Title for the expression, i.e. a short string describing its purpose.
        This can be used e.g. in UIs which allow to enter the expression.
        """
        return pulumi.get(self, "title")

    @title.setter
    def title(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "title", value)


@pulumi.input_type
class WorkforcePoolProviderOidcArgs:
    def __init__(__self__, *,
                 client_id: pulumi.Input[str],
                 issuer_uri: pulumi.Input[str],
                 client_secret: Optional[pulumi.Input['WorkforcePoolProviderOidcClientSecretArgs']] = None,
                 web_sso_config: Optional[pulumi.Input['WorkforcePoolProviderOidcWebSsoConfigArgs']] = None):
        """
        :param pulumi.Input[str] client_id: The client ID. Must match the audience claim of the JWT issued by the identity provider.
        :param pulumi.Input[str] issuer_uri: The OIDC issuer URI. Must be a valid URI using the 'https' scheme.
        :param pulumi.Input['WorkforcePoolProviderOidcClientSecretArgs'] client_secret: The optional client secret. Required to enable Authorization Code flow for web sign-in.
               Structure is documented below.
        :param pulumi.Input['WorkforcePoolProviderOidcWebSsoConfigArgs'] web_sso_config: Configuration for web single sign-on for the OIDC provider. Here, web sign-in refers to console sign-in and gcloud sign-in through the browser.
               Structure is documented below.
        """
        pulumi.set(__self__, "client_id", client_id)
        pulumi.set(__self__, "issuer_uri", issuer_uri)
        if client_secret is not None:
            pulumi.set(__self__, "client_secret", client_secret)
        if web_sso_config is not None:
            pulumi.set(__self__, "web_sso_config", web_sso_config)

    @property
    @pulumi.getter(name="clientId")
    def client_id(self) -> pulumi.Input[str]:
        """
        The client ID. Must match the audience claim of the JWT issued by the identity provider.
        """
        return pulumi.get(self, "client_id")

    @client_id.setter
    def client_id(self, value: pulumi.Input[str]):
        pulumi.set(self, "client_id", value)

    @property
    @pulumi.getter(name="issuerUri")
    def issuer_uri(self) -> pulumi.Input[str]:
        """
        The OIDC issuer URI. Must be a valid URI using the 'https' scheme.
        """
        return pulumi.get(self, "issuer_uri")

    @issuer_uri.setter
    def issuer_uri(self, value: pulumi.Input[str]):
        pulumi.set(self, "issuer_uri", value)

    @property
    @pulumi.getter(name="clientSecret")
    def client_secret(self) -> Optional[pulumi.Input['WorkforcePoolProviderOidcClientSecretArgs']]:
        """
        The optional client secret. Required to enable Authorization Code flow for web sign-in.
        Structure is documented below.
        """
        return pulumi.get(self, "client_secret")

    @client_secret.setter
    def client_secret(self, value: Optional[pulumi.Input['WorkforcePoolProviderOidcClientSecretArgs']]):
        pulumi.set(self, "client_secret", value)

    @property
    @pulumi.getter(name="webSsoConfig")
    def web_sso_config(self) -> Optional[pulumi.Input['WorkforcePoolProviderOidcWebSsoConfigArgs']]:
        """
        Configuration for web single sign-on for the OIDC provider. Here, web sign-in refers to console sign-in and gcloud sign-in through the browser.
        Structure is documented below.
        """
        return pulumi.get(self, "web_sso_config")

    @web_sso_config.setter
    def web_sso_config(self, value: Optional[pulumi.Input['WorkforcePoolProviderOidcWebSsoConfigArgs']]):
        pulumi.set(self, "web_sso_config", value)


@pulumi.input_type
class WorkforcePoolProviderOidcClientSecretArgs:
    def __init__(__self__, *,
                 value: Optional[pulumi.Input['WorkforcePoolProviderOidcClientSecretValueArgs']] = None):
        """
        :param pulumi.Input['WorkforcePoolProviderOidcClientSecretValueArgs'] value: The value of the client secret.
               Structure is documented below.
        """
        if value is not None:
            pulumi.set(__self__, "value", value)

    @property
    @pulumi.getter
    def value(self) -> Optional[pulumi.Input['WorkforcePoolProviderOidcClientSecretValueArgs']]:
        """
        The value of the client secret.
        Structure is documented below.
        """
        return pulumi.get(self, "value")

    @value.setter
    def value(self, value: Optional[pulumi.Input['WorkforcePoolProviderOidcClientSecretValueArgs']]):
        pulumi.set(self, "value", value)


@pulumi.input_type
class WorkforcePoolProviderOidcClientSecretValueArgs:
    def __init__(__self__, *,
                 plain_text: pulumi.Input[str],
                 thumbprint: Optional[pulumi.Input[str]] = None):
        """
        :param pulumi.Input[str] plain_text: The plain text of the client secret value.
               **Note**: This property is sensitive and will not be displayed in the plan.
        :param pulumi.Input[str] thumbprint: (Output)
               A thumbprint to represent the current client secret value.
        """
        pulumi.set(__self__, "plain_text", plain_text)
        if thumbprint is not None:
            pulumi.set(__self__, "thumbprint", thumbprint)

    @property
    @pulumi.getter(name="plainText")
    def plain_text(self) -> pulumi.Input[str]:
        """
        The plain text of the client secret value.
        **Note**: This property is sensitive and will not be displayed in the plan.
        """
        return pulumi.get(self, "plain_text")

    @plain_text.setter
    def plain_text(self, value: pulumi.Input[str]):
        pulumi.set(self, "plain_text", value)

    @property
    @pulumi.getter
    def thumbprint(self) -> Optional[pulumi.Input[str]]:
        """
        (Output)
        A thumbprint to represent the current client secret value.
        """
        return pulumi.get(self, "thumbprint")

    @thumbprint.setter
    def thumbprint(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "thumbprint", value)


@pulumi.input_type
class WorkforcePoolProviderOidcWebSsoConfigArgs:
    def __init__(__self__, *,
                 assertion_claims_behavior: pulumi.Input[str],
                 response_type: pulumi.Input[str]):
        """
        :param pulumi.Input[str] assertion_claims_behavior: The behavior for how OIDC Claims are included in the `assertion` object used for attribute mapping and attribute condition.
               * MERGE_USER_INFO_OVER_ID_TOKEN_CLAIMS: Merge the UserInfo Endpoint Claims with ID Token Claims, preferring UserInfo Claim Values for the same Claim Name. This option is available only for the Authorization Code Flow.
               * ONLY_ID_TOKEN_CLAIMS: Only include ID Token Claims.
               Possible values are: `MERGE_USER_INFO_OVER_ID_TOKEN_CLAIMS`, `ONLY_ID_TOKEN_CLAIMS`.
        :param pulumi.Input[str] response_type: The Response Type to request for in the OIDC Authorization Request for web sign-in.
               The `CODE` Response Type is recommended to avoid the Implicit Flow, for security reasons.
               * CODE: The `response_type=code` selection uses the Authorization Code Flow for web sign-in. Requires a configured client secret.
               * ID_TOKEN: The `response_type=id_token` selection uses the Implicit Flow for web sign-in.
               Possible values are: `CODE`, `ID_TOKEN`.
        """
        pulumi.set(__self__, "assertion_claims_behavior", assertion_claims_behavior)
        pulumi.set(__self__, "response_type", response_type)

    @property
    @pulumi.getter(name="assertionClaimsBehavior")
    def assertion_claims_behavior(self) -> pulumi.Input[str]:
        """
        The behavior for how OIDC Claims are included in the `assertion` object used for attribute mapping and attribute condition.
        * MERGE_USER_INFO_OVER_ID_TOKEN_CLAIMS: Merge the UserInfo Endpoint Claims with ID Token Claims, preferring UserInfo Claim Values for the same Claim Name. This option is available only for the Authorization Code Flow.
        * ONLY_ID_TOKEN_CLAIMS: Only include ID Token Claims.
        Possible values are: `MERGE_USER_INFO_OVER_ID_TOKEN_CLAIMS`, `ONLY_ID_TOKEN_CLAIMS`.
        """
        return pulumi.get(self, "assertion_claims_behavior")

    @assertion_claims_behavior.setter
    def assertion_claims_behavior(self, value: pulumi.Input[str]):
        pulumi.set(self, "assertion_claims_behavior", value)

    @property
    @pulumi.getter(name="responseType")
    def response_type(self) -> pulumi.Input[str]:
        """
        The Response Type to request for in the OIDC Authorization Request for web sign-in.
        The `CODE` Response Type is recommended to avoid the Implicit Flow, for security reasons.
        * CODE: The `response_type=code` selection uses the Authorization Code Flow for web sign-in. Requires a configured client secret.
        * ID_TOKEN: The `response_type=id_token` selection uses the Implicit Flow for web sign-in.
        Possible values are: `CODE`, `ID_TOKEN`.
        """
        return pulumi.get(self, "response_type")

    @response_type.setter
    def response_type(self, value: pulumi.Input[str]):
        pulumi.set(self, "response_type", value)


@pulumi.input_type
class WorkforcePoolProviderSamlArgs:
    def __init__(__self__, *,
                 idp_metadata_xml: pulumi.Input[str]):
        """
        :param pulumi.Input[str] idp_metadata_xml: SAML Identity provider configuration metadata xml doc.
               The xml document should comply with [SAML 2.0 specification](https://docs.oasis-open.org/security/saml/v2.0/saml-metadata-2.0-os.pdf).
               The max size of the acceptable xml document will be bounded to 128k characters.
               The metadata xml document should satisfy the following constraints:
               1) Must contain an Identity Provider Entity ID.
               2) Must contain at least one non-expired signing key certificate.
               3) For each signing key:
               a) Valid from should be no more than 7 days from now.
               b) Valid to should be no more than 10 years in the future.
               4) Up to 3 IdP signing keys are allowed in the metadata xml.
               When updating the provider's metadata xml, at least one non-expired signing key
               must overlap with the existing metadata. This requirement is skipped if there are
               no non-expired signing keys present in the existing metadata.
        """
        pulumi.set(__self__, "idp_metadata_xml", idp_metadata_xml)

    @property
    @pulumi.getter(name="idpMetadataXml")
    def idp_metadata_xml(self) -> pulumi.Input[str]:
        """
        SAML Identity provider configuration metadata xml doc.
        The xml document should comply with [SAML 2.0 specification](https://docs.oasis-open.org/security/saml/v2.0/saml-metadata-2.0-os.pdf).
        The max size of the acceptable xml document will be bounded to 128k characters.
        The metadata xml document should satisfy the following constraints:
        1) Must contain an Identity Provider Entity ID.
        2) Must contain at least one non-expired signing key certificate.
        3) For each signing key:
        a) Valid from should be no more than 7 days from now.
        b) Valid to should be no more than 10 years in the future.
        4) Up to 3 IdP signing keys are allowed in the metadata xml.
        When updating the provider's metadata xml, at least one non-expired signing key
        must overlap with the existing metadata. This requirement is skipped if there are
        no non-expired signing keys present in the existing metadata.
        """
        return pulumi.get(self, "idp_metadata_xml")

    @idp_metadata_xml.setter
    def idp_metadata_xml(self, value: pulumi.Input[str]):
        pulumi.set(self, "idp_metadata_xml", value)


@pulumi.input_type
class WorkloadIdentityPoolProviderAwsArgs:
    def __init__(__self__, *,
                 account_id: pulumi.Input[str]):
        """
        :param pulumi.Input[str] account_id: The AWS account ID.
        """
        pulumi.set(__self__, "account_id", account_id)

    @property
    @pulumi.getter(name="accountId")
    def account_id(self) -> pulumi.Input[str]:
        """
        The AWS account ID.
        """
        return pulumi.get(self, "account_id")

    @account_id.setter
    def account_id(self, value: pulumi.Input[str]):
        pulumi.set(self, "account_id", value)


@pulumi.input_type
class WorkloadIdentityPoolProviderOidcArgs:
    def __init__(__self__, *,
                 issuer_uri: pulumi.Input[str],
                 allowed_audiences: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 jwks_json: Optional[pulumi.Input[str]] = None):
        """
        :param pulumi.Input[str] issuer_uri: The OIDC issuer URL.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] allowed_audiences: Acceptable values for the `aud` field (audience) in the OIDC token. Token exchange
               requests are rejected if the token audience does not match one of the configured
               values. Each audience may be at most 256 characters. A maximum of 10 audiences may
               be configured.
               If this list is empty, the OIDC token audience must be equal to the full canonical
               resource name of the WorkloadIdentityPoolProvider, with or without the HTTPS prefix.
               For example:
               ```python
               import pulumi
               ```
        :param pulumi.Input[str] jwks_json: OIDC JWKs in JSON String format. For details on definition of a
               JWK, see https:tools.ietf.org/html/rfc7517. If not set, then we
               use the `jwks_uri` from the discovery document fetched from the
               .well-known path for the `issuer_uri`. Currently, RSA and EC asymmetric
               keys are supported. The JWK must use following format and include only
               the following fields:
               ```python
               import pulumi
               ```
        """
        pulumi.set(__self__, "issuer_uri", issuer_uri)
        if allowed_audiences is not None:
            pulumi.set(__self__, "allowed_audiences", allowed_audiences)
        if jwks_json is not None:
            pulumi.set(__self__, "jwks_json", jwks_json)

    @property
    @pulumi.getter(name="issuerUri")
    def issuer_uri(self) -> pulumi.Input[str]:
        """
        The OIDC issuer URL.
        """
        return pulumi.get(self, "issuer_uri")

    @issuer_uri.setter
    def issuer_uri(self, value: pulumi.Input[str]):
        pulumi.set(self, "issuer_uri", value)

    @property
    @pulumi.getter(name="allowedAudiences")
    def allowed_audiences(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        Acceptable values for the `aud` field (audience) in the OIDC token. Token exchange
        requests are rejected if the token audience does not match one of the configured
        values. Each audience may be at most 256 characters. A maximum of 10 audiences may
        be configured.
        If this list is empty, the OIDC token audience must be equal to the full canonical
        resource name of the WorkloadIdentityPoolProvider, with or without the HTTPS prefix.
        For example:
        ```python
        import pulumi
        ```
        """
        return pulumi.get(self, "allowed_audiences")

    @allowed_audiences.setter
    def allowed_audiences(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "allowed_audiences", value)

    @property
    @pulumi.getter(name="jwksJson")
    def jwks_json(self) -> Optional[pulumi.Input[str]]:
        """
        OIDC JWKs in JSON String format. For details on definition of a
        JWK, see https:tools.ietf.org/html/rfc7517. If not set, then we
        use the `jwks_uri` from the discovery document fetched from the
        .well-known path for the `issuer_uri`. Currently, RSA and EC asymmetric
        keys are supported. The JWK must use following format and include only
        the following fields:
        ```python
        import pulumi
        ```
        """
        return pulumi.get(self, "jwks_json")

    @jwks_json.setter
    def jwks_json(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "jwks_json", value)


